Report Security Issues
Responsible Disclosure Policy
In u‑blox, the safety and security of our customers and users has always been a top priority. We are dedicated to improving our products continuously, focusing on changing market needs, technologic breakthrough, as well as evolving threat surface and new attack vectors. This Responsible Disclosure Policy is in place to identify new vulnerabilities and security issues in the relevant hardware, software or services provided by u‑blox (“u‑blox Products”) and to address them in a timely manner.
You can use this platform to report a vulnerability/security issue in any u‑blox Product, excluding end-of-life u‑blox products/services.
Reporting a vulnerability in a good faith and by academical/private research is possible through our Responsible Disclosure Policy and is not going to be penalized. Targeted, malicious or persistent attacks, however, are strictly forbidden and will be reported to the relevant authorities in accordance with the relevant laws.
How to report
If you are an existing u‑blox customer, you can submit a vulnerability/security issue report creating a support ticket in u‑blox support portal.
In other cases, please contact us at [email protected].
PGP public key and fingerprint: 359F 2E00 85CF 57DF 45B5 3970 B106 63C8 757F 1A21
Do not send us any issue information in the initial email. Instead, send us the following information:
- Your contact details
- Preferred form of secure communication (e.g. PGP or S/MIME)
Reporting the issue
After we have established the secure communication, please send us the following information to be able to address the issue:
- u‑blox Product(s) affected, including version numbers;
- Vulnerability/security issue type, e.g. spoofing, tampering, remote code execution, information disclosure, denial of service, elevation of privilege;
- When and how did you learn about the vulnerability/security issue?
- Steps to reproduce the vulnerability/security issue including technical details;
- Supporting evidence, e.g. logs, screenshots, pictures, exploit code.
u‑blox will assess each submission received. After your message, the following actions will be undertaken:
- The vulnerability/security issue will be prioritized analyzing the potential impact and exposure;
- We will confirm to you that we have received your report by an assigned security representative;
- We might request additional information from you as needed to investigate and resolve the issue;
- According to the nature of the vulnerability/security issue, we will fix and notify you, our customers and/or regulatory authorities, or take other actions as necessary.
To prevent exploitation of reported vulnerabilities/security issues before workarounds or fixes are available, we kindly ask you to refrain from disclosing the vulnerability/security issue until u‑blox allows you to do so.
There is currently no fixed reward (“bug bounty program”) in place. u‑blox may decide to recognize your efforts in the Acknowledgements below. Please also note that as to your contribution made the terms and conditions for the u‑blox website apply, and u‑blox will thus be able to use any information provided in any commercial context.
We would like to thank all individuals and companies who have reported security issues in u‑blox infrastructure or Products.
|Ronak Nahar||Aishwarya Kendle||Ali Razzaq||Mohammed Adam|
|Usama Abid||Avi Chakravarti||Badal Sardhara||Merbin Russel|
We continuously monitor and investigate reported security issues. In this section, we publish confirmed security vulnerabilities related to u‑blox Products.
|Spectra coexistence vulnerability||
|Please refer to the information note. A new firmware is now available that patches the issue.|
|CVE-2019-16336, CVE-2019-17519, CVE-2019-17517, CVE-2019-17518, CVE-2019-17520, CVE-2019-19195, CVE-2019-19196, CVE-2019-17061, CVE-2019-17060, CVE-2019-19192, CVE-2019-19193, CVE-2019-19194 (Sweyntooth)||
Please refer to the information note. A patch is available for JODY-W1 and R41Z. u‑blox is waiting for a fix for JODY-W2 and EMMY-W1 from NXP Semiconductors.
Fault injection vulnerability in nRF52 chips
|Please refer to the design considerations and product recommendations in the information note.|
|CVE-2019-15126 (Kr00k)||JODY-W1 series||You can download the latest firmware version CLUTCH, FW v188.8.131.52, including the fix. For older firmware releases (S5.2 (SDIO), P8.2 (PCIe), Accelerator (PCIe and SDIO), Brakepad (PCIe and SDIO)), Cypress has provided exception firmware releases that include the fix. Customers can download them through Cypress web site or contact u‑blox directly.|
|CVE-2019-9506 (KNOB)||NINA-B2, NINA-W13, NINA-W15, ODIN-W2; JODY, ELLA, EMMY families||For host-based products (JODY, ELLA, EMMY), customers can download the fixes from the corresponding chip vendors. For NINA-B2/W15/W13, the issue is fixed in the u-connectXpress versions v2.1.0 and higher. For ODIN-W2, please contact your u‑blox representative.|